Abdulhadi Hospital Listed by devman Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 1, 2025, the ransomware group devman listed Abdulhadi Hospital on its leak site, claiming to have carried out an attack that resulted in the exfiltration of internal files. The listing references a ransom demand of 350k and states that 246gb of data were taken. No confirmation of the incident has been issued by the hospital, and the number of individuals whose information may be involved remains unknown. This development occurs against a backdrop of sustained ransomware activity targeting healthcare providers, where attackers continue to exploit the sector’s reliance on connected systems and the high value placed on operational continuity.

Inside the incident

The available information is limited to the group’s public listing. It states that internal files were removed during a ransomware attack and offers a ransom amount of 350k in connection with 246gb of material. No date of the intrusion, method of initial access, or confirmation that files were encrypted has been disclosed. The reference to ecaretest.com appears in the listing but its precise role is not explained in the available record.

Who is devman?

Devman is a ransomware operation that follows the double-extortion model common among current threat actors. The group typically claims to have both encrypted systems and removed data, then uses a leak site to pressure victims by threatening to publish the material if payment is not received. Such groups often maintain a public presence to advertise their activities and to signal to other potential targets. The listing of Abdulhadi Hospital constitutes the group’s claim regarding this case; independent verification of the claims has not been reported.

Who is Abdulhadi Hospital?

Abdulhadi Hospital is a healthcare provider. Organisations of this type maintain networks that support clinical operations, administrative functions, and the storage of records necessary for patient care. Disruptions to these systems can affect appointment scheduling, diagnostic services, and the ability to access historical information during treatment. Because healthcare delivery depends on timely data access, incidents that target such facilities receive attention from regulators and the public even when the precise impact is still unclear.

What data was at risk

The listing states that internal files were exfiltrated. No further breakdown of file categories or record types has been provided. Healthcare organisations routinely hold patient identifiers, clinical notes, laboratory results, imaging data, and administrative records. Whether any of these categories are present in the material referenced by the group is not confirmed by the available facts.

What's at stake

Individuals whose records may be involved face the possibility that personal or medical information could be published or misused. For the hospital, the incident raises questions about the security of systems that support care delivery and regulatory compliance. Until the scope of the data and the status of any decryption or restoration efforts are clarified, the practical consequences for patients and staff remain difficult to quantify.

What to do if you're exposed

Anyone who believes their information may be connected to the hospital should monitor official statements from Abdulhadi Hospital and any notifications issued by regulators. Practical steps include reviewing account statements for unusual activity, enabling multi-factor authentication on important services, and considering a credit freeze if financial details are thought to be at risk. Readers can also run a free exposure scan of their email address against known breach data to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.